Commands to Check Which Firewall Policy Matches Traffic

Quick Answer

The answer is the diagnose debug flow and diagnose firewall iprope list commands. These two diagnostic commands are correct because they allow a FortiGate administrator to directly observe how traffic is being processed by the firewall engine. The diagnose debug flow command traces a specific packet’s path through the firewall, showing exactly which policy it matches or if it is dropped, while diagnose firewall iprope list displays real-time policy hit counters, revealing whether traffic is hitting an unexpected rule. On the Fortinet NSE 4 Network Security Professional exam, this question tests your ability to troubleshoot policy misconfigurations beyond simply checking the policy table—a common trap is assuming that a policy that looks correct is actually being matched, when in fact a different policy with a higher priority or broader source range is intercepting the traffic. A useful memory tip is to think of “flow” for the packet’s journey and “list” for the hit counts—if the flow shows a different policy number than expected, the list will confirm its hit count rising.